refactor(db): 移除无意义 actor，修复 history 多租户与模型

- 删除 entries_history / audit_log / secrets_history 的 actor 列及写入逻辑
- MCP secrets_history 透传当前 user_id
- Entry 增加 user_id，search 查询不再用伪 UUID
- 迁移：保留 users.api_key，从 api_keys 表回退时生成新明文 key 并删表
- 文档：audit_log auth 语义、API Key 存储说明

Made-with: Cursor

crates/secrets-core/src/audit.rs

@@ -5,11 +5,6 @@ use uuid::Uuid;
 pub const ACTION_LOGIN: &str = "login";
 pub const NAMESPACE_AUTH: &str = "auth";
 
-/// Return the current OS user as the audit actor (falls back to empty string).
-pub fn current_actor() -> String {
-    std::env::var("USER").unwrap_or_default()
-}
-
 fn login_detail(provider: &str, client_ip: Option<&str>, user_agent: Option<&str>) -> Value {
     json!({
         "provider": provider,
@@ -27,11 +22,10 @@ pub async fn log_login(
     client_ip: Option<&str>,
     user_agent: Option<&str>,
 ) {
-    let actor = current_actor();
     let detail = login_detail(provider, client_ip, user_agent);
     let result: Result<_, sqlx::Error> = sqlx::query(
-        "INSERT INTO audit_log (user_id, action, namespace, kind, name, detail, actor) \
-         VALUES ($1, $2, $3, $4, $5, $6, $7)",
+        "INSERT INTO audit_log (user_id, action, namespace, kind, name, detail) \
+         VALUES ($1, $2, $3, $4, $5, $6)",
     )
     .bind(user_id)
     .bind(ACTION_LOGIN)
@@ -39,14 +33,13 @@ pub async fn log_login(
     .bind(kind)
     .bind(provider)
     .bind(&detail)
-    .bind(&actor)
     .execute(pool)
     .await;
 
     if let Err(e) = result {
         tracing::warn!(error = %e, kind, provider, "failed to write login audit log");
     } else {
-        tracing::debug!(kind, provider, ?user_id, actor, "login audit logged");
+        tracing::debug!(kind, provider, ?user_id, "login audit logged");
     }
 }
 
@@ -60,10 +53,9 @@ pub async fn log_tx(
     name: &str,
     detail: Value,
 ) {
-    let actor = current_actor();
     let result: Result<_, sqlx::Error> = sqlx::query(
-        "INSERT INTO audit_log (user_id, action, namespace, kind, name, detail, actor) \
-         VALUES ($1, $2, $3, $4, $5, $6, $7)",
+        "INSERT INTO audit_log (user_id, action, namespace, kind, name, detail) \
+         VALUES ($1, $2, $3, $4, $5, $6)",
     )
     .bind(user_id)
     .bind(action)
@@ -71,14 +63,13 @@ pub async fn log_tx(
     .bind(kind)
     .bind(name)
     .bind(&detail)
-    .bind(&actor)
     .execute(&mut **tx)
     .await;
 
     if let Err(e) = result {
         tracing::warn!(error = %e, "failed to write audit log");
     } else {
-        tracing::debug!(action, namespace, kind, name, actor, "audit logged");
+        tracing::debug!(action, namespace, kind, name, "audit logged");
     }
 }